How do I track my website traffic and where it comes from?
Every visit carries two clues.Some arrive with none.
To see where your website traffic comes from, open the acquisition report in your analytics tool: in Google Analytics 4 that is Reports, then Acquisition, then Traffic acquisition. Every row there comes from two clues a visit brings with it: the tags on the address it landed on (UTM parameters, or an ad click ID such as gclid) and the referrer, the page that sent it. Tags are read first. The tool then sorts each visit into a channel: search, paid, social, email, referral, AI assistants, or direct when there is no clue at all. Below: each channel, why sources go missing, and a decoder for any visit.
By the Builderify team
How does analytics know where
a visitor came from?
It reads the clues in order.
Your analytics tool never sees the click itself. It sees the address the visitor landed on, and the referrer their browser sent with it. From those two it works out a source (the site or newsletter), a medium (the kind of link) and a channel (the group the source and medium fall into). Most tools read the clues in this order and stop at the first one that answers.
-
01
UTM tags
utm_source, utm_medium and utm_campaign on the landing URL. You add them to your own links, so they say exactly what you wrote.
-
02
Ad click ID
gclid from Google Ads, msclkid from Microsoft Advertising, added by their auto-tagging. They mark a paid click even without tags.
-
03
Referrer
The site that sent the visit, matched against lists of search engines, social networks, webmail and AI assistants. Anything else is a referral.
-
04
Nothing
No tags, no click ID, no referrer. The visit is filed as direct, whether it was typed in or clicked in an app that hid where it came from.
One exception worth knowing: Google Analytics 4 puts Google Ads auto-tagging ahead of manual tags, so a link carrying both a gclid and UTM tags is credited to Google Ads.Google Ads Help Knowing the source is the first step; which numbers to watch for each one is the subject of the guide to website metrics worth tracking.
Where did this visit come from?
Paste it and see.
Paste the address a visitor landed on and, if you have it, the referrer. The decoder reads the clues in the order above and says which source, medium and channel the visit falls into, and why. When there is nothing to read, it says why the visit shows as direct and how to tag the link. It runs in your browser.
The referrer is in your server logs, in GA4’s Page referrer dimension, or in document.referrer in the browser console of the page you landed on.
Links in emails and newsletters.
- Source
- newsletter
- Medium
The landing URL carries campaign tags: source newsletter, medium email. Tags are read before the referrer, so this visit is filed under newsletter / email whichever page the click came from.
How it reads. UTM tags first, then Google Ads, Microsoft Advertising and Facebook click IDs, then the referrer’s address against lists of common search engines, social networks, webmail services and AI assistants. Channel names follow Google’s default channel group, where it documents them.Google
A general reading. Every analytics tool keeps its own lists and its own order, so the same visit can land in slightly different places in GA4, Plausible or Builderify. Where GA4 is documented to differ, the decoder says so under the result.
Your own site as the referrer usually means a second domain or subdomain that isn’t linked to the first. The guide to cross-domain tracking covers how to link them.
Traffic sources explained,
channel by channel.
A channel is a group of sources that reached you the same way. GA4’s default channel group has nineteen of them, from Affiliates to SMS. These are the seven you will meet most often.Google The right-hand column is the clue that puts a visit there.
| Channel | What it is | How it is detected |
|---|---|---|
| Organic search | Unpaid results on Google, Bing, DuckDuckGo and other search engines. In GA4 this includes Google’s AI Overviews and AI Mode. | A referrer on a list of search engines, or a tagged link with utm_medium=organic. The words searched aren’t passed on. |
| Paid search, paid social | Clicks on ads you pay for, on search engines or social networks. | An ad click ID (gclid, msclkid), or a medium such as cpc, ppc or anything starting with paid, together with a search or social source. |
| Unpaid posts, profiles, groups and shares on Facebook, Instagram, LinkedIn, X, Reddit and the rest. | A referrer on a list of social networks, or a medium such as social. Facebook adds fbclid to links clicked on its platform, so it proves Facebook but not an ad.SagaPixel |
|
| Links in your newsletters, sequences and one-off emails. | Tags only: a source or medium of email. Most email programs send no referrer, and a click in webmail arrives as a referral from the mail site. |
|
| Referral | A link on another website: a directory, a supplier, a blog, a news story. | A referrer that isn’t on any of the other lists, or a medium of referral. |
| AI assistant | Links in answers from ChatGPT, Gemini, Copilot, Perplexity and similar tools. | A referrer on a list of AI assistants. GA4 added an AI Assistant channel for these, naming ChatGPT, Gemini, Deepseek, Copilot and Grok.Google How to be the answer they link to is its own guide: getting your website into ChatGPT. |
| Direct | Typed addresses and bookmarks, plus every click whose referrer was lost on the way. | No tags, no click ID and no referrer. GA4 only calls it Direct when the source is (direct); tagged visits that match no rule go to Unassigned instead. |
Why can’t I see where
some visitors came from?
Because the referrer is the browser’s to send, and it often doesn’t. Under the default policy, strict-origin-when-cross-origin, a browser tells your site only which site the visitor came from, such as https://www.google.com, not the page; and from a secure page to an http:// one, nothing at all.MDN
Each of the leaks on the right turns a real click into direct traffic, or loses the visit entirely. Why direct runs so high, and how to sort what is in it, has its own guide: what direct traffic means.
Apps and email programs
A link tapped in WhatsApp, Slack, a phone’s mail app or a PDF opens with no page behind it, so there is no referrer to send.
https to http
A site still served over http:// gets no referrer from secure pages, which is nearly all of them.
Referrer policies
A site can send less or nothing: a no-referrer policy, or rel="noreferrer" on a single link, removes the header.
Redirects that drop tags
A short link, a tracking redirect or an http-to-https hop that doesn’t pass the query string on loses the UTM tags and click IDs. Google asks for the gclid to reach the final landing page.
Consent banners
If a visitor declines analytics cookies, a banner that blocks the tag means the visit isn’t counted at all, source and all. Only a tool that can count without cookies still sees it.
Your own pages
A payment page or a second domain that sends people back can start a fresh visit credited to yourself, or to the payment provider.
Google Ads on keeping the gclid through redirects:Google Ads Help Microsoft says the same of msclkid.Microsoft On how a cookie banner affects Google’s tags, see the guide to Consent Mode v2. Traffic that isn’t people at all, such as scrapers and data-centre visits, is the subject of the guide to bot traffic in analytics.
How to see where website visitors come from,
in three places.
Your analytics tool shows the sources; Search Console shows the searches behind organic search. Neither shows which company or person a visitor was; for what can and can’t be known there, read can you see who visits your website.
Google Analytics 4
Its default dimension is the session’s default channel grouping, one row per channel. Switch the dimension to Session source / medium to see each site, and type a pair such as google / organic into the search box above the table to find one.Google
Google Search Console
The searches that showed your site, with clicks, impressions, click-through rate and average position, for the last three months by default.Google It is the only place the search terms appear, and not all of them: queries made very rarely, or containing personal information, are left out.Google
Builderify User Journey
Every source with its visits, visitors, bounce rate, pages per visit and the share that reached a goal. Open one for its landing pages, campaigns, the exact pages that linked to you and how much of it is real people. More in chapter 07.
Sources tell you which visits arrived; the next question is which of them got in touch. The guide to tracking form submissions ties each enquiry back to the visit it came from.
The one fix you control:
say where the link was.
You can’t make a browser send a referrer, but you can put the answer in the link. Tags travel with the address, so they survive apps, email programs and referrer policies. Google asks for three on every tagged link: utm_source, utm_medium and utm_campaign.Google
https://yoursite.com/offer?utm_source=newsletter&utm_medium=email&utm_campaign=october
- utm_source
- Who carries the link: newsletter, facebook, a partner’s name.
- utm_medium
- What kind of link: email, social, cpc, referral. This is what picks the channel.
- utm_campaign
- Which push it belongs to, so two newsletters don’t blur into one.
Tag what you share, not your own pages. Tag links in emails, social posts and bios, QR codes, ads and partner sites. Never tag links between pages of your own site: in many tools a new tag starts a new visit, and your own link replaces the place the visitor really came from.
Use the same words every time, in lower case, because Newsletter and newsletter can count as two sources. To follow a tagged campaign all the way to the leads it brings, see how to track which campaign brings leads. Builderify Short Links can add the five UTM tags to a link’s destination for you.
How User Journey
names a source.
Then tells you if it paid.
User Journey gives each visit one source, read in the same order as the decoder: the utm_source tag, then an ad click ID, then the referrer. It shows sources by name rather than in GA4-style channel groups, and puts each one next to how many of its visitors went on to reach your goals.
Tags and click IDs first
UTM tags and ad click IDs are read from the landing URL before anything is stripped. A utm_source becomes the source exactly as written; a gclid reads as Google Ads, an msclkid as Microsoft Ads, and an fbclid as Facebook.
Referrers, resolved into names
Referrers are matched against a list of known search engines and networks: Google, Bing, DuckDuckGo, Facebook, Instagram, LinkedIn, Reddit, YouTube and more, with t.co and x.com read as one source, X (Twitter).
Direct, and your own site
A visit with no referrer is Direct. A referrer from your own site, one of its subdomains or a domain you have linked is Internal, never a referral.
First touch, kept
Each visitor’s first source stays on their journey. A visitor who comes back through a second source is counted under each, visit by visit.
Which channels pay off
Every source with its visits, bounce rate, pages per visit and the share that reached a goal. Open one for the goals its visitors reached, in that visit or later, its landing pages, its campaigns and the exact pages that linked to you.
Real people, set apart
Each source report shows how much of it is real people, VPN or proxy traffic and datacenter machines, and one switch leaves the flagged traffic out of every figure.
Visitors who say no still count. With “Wait for cookie consent” on, only visitors who allow analytics in your cookie consent banner get a journey. Everyone else can still be counted anonymously, without a cookie or a stored ID, so a declined banner doesn’t erase the visit.
One source, one person, one path. Because Journey records visitors rather than sessions, you can open any visitor from a source and read what they did next. The guide to user journey tracking covers that view. Its list of named sources doesn’t include AI assistants yet, so tag the links you can.
A tracked visitor journey costs 0.1 credits. Every account gets 250 free credits a month, and one-time packs start at $9 with no monthly fee. See pricing.
Start freeTraffic sources, before you ask.
Open the acquisition or sources report in your analytics tool. In Google Analytics 4 it is Reports, then Acquisition, then Traffic acquisition, which groups visits by channel; switch the dimension to session source / medium to see each site. For the searches behind organic search, use the Performance report in Google Search Console.
From two clues the visit brings with it: tags on the landing address, such as UTM parameters or an ad click ID like gclid, and the referrer, the site the browser says sent the visitor. Tags are read first. The tool then sorts each visit into a channel such as organic search, paid search, social, email, referral or direct.
The source is where the visit came from, such as google or newsletter. The medium is the kind of link, such as organic, email or cpc. A channel is a group of source and medium pairs that reached you the same way, such as Organic Search or Email, and is what most reports show first.
Because there was no referrer and no tag. Apps, email programs and PDFs send no referrer, browsers send none from a secure page to an http:// one, some sites switch it off, and redirects can drop the tags. Those visits are filed as direct. Adding UTM tags to the links you share is the fix you control.
Yes. User Journey gives every visit a source, read from its utm_source tag first, then a Google Ads, Microsoft Ads or Facebook click ID, then the referrer matched against a list of known search engines and networks. A visit with no referrer reads as Direct, and each source is shown with the share of its visitors who reached a goal.
Sources
- Google Default channel group, Analytics Help
- Google [GA4] Traffic acquisition report, Analytics Help
- Google URL builders: Collect campaign data with custom URLs, Analytics Help
- Google About auto-tagging, Google Ads Help
- Microsoft How do I see if Microsoft Advertising auto-tagging works?, Microsoft Advertising Help
- Google Performance report (Search results): Overview and basic setup, Search Console Help
- Google About Search Console data, Search Console Help
- MDN Referrer-Policy header, MDN Web Docs
- SagaPixel What is fbclid and how to remove it from your analytics
The Google, Microsoft, MDN and SagaPixel pages were read on 29 October 2026. How User Journey names a source comes from Builderify’s own code; the other Builderify details come from the module pages and the rate card on this site. The decoder is a general reading modelled on common channel rules, not a copy of any one tool’s.
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.